Privacy Policy

Version 4 · in effect since October 3, 2026

Last updated: 3 October 2026

This policy explains what personal data we process when you use the Lumara platform (lumara.md), why, on what legal basis, who we share it with, how long we keep it and what rights you have. We process data in accordance with Law No. 195/2024 on the protection of personal data.

1. The controller

The lumara.md website is run by SRL "BALAN PRO" (IDNO 1013600015807), registered office at MD-4829, Măgdăcești village, Criuleni district, Republic of Moldova, which acts as the controller of personal data ("Lumara", "we", "us"). For any question about your data, you can send us a written request to this address.

2. What data we process, why and on what basis

Account and sign-in

  • Data: name, e-mail address, phone number, password (kept only in irreversibly encrypted form — a hash), preferred language, account type (Client or Specialist); when signing in with Google, Apple or Facebook — the account identifier and the basic data received from that provider (name, e-mail, profile photo, where applicable); two-step authentication data (the secret key and backup codes); active sessions, with the IP address and browser type.
  • Purpose: creating and managing the account, secure sign-in, sending SMS codes and e-mails to confirm the address or reset the password.
  • Basis: performance of the contract (the Terms and Conditions) and our legitimate interest in protecting accounts.

Public profile and activity on the Platform

  • Data: for Clients — the locality and contact phone number; for Specialists — the profile photo, description, service categories, prices, areas served, portfolio (photos, links, certificates) and, for companies, the company name and IDNO; Requests (description, budget, deadline, locality, photos), Offers, Orders and their history, reviews and replies, the favourites list, notification preferences.
  • Purpose: connecting Clients with Specialists and displaying profiles, Requests and reviews.
  • Basis: performance of the contract. The Specialist's profile, portfolio, reviews and replies to reviews are public.

Published photos (profile, portfolio, requests, chat) are re-processed automatically, and their metadata (for example, GPS location or camera model) is removed.

Messages

  • Data: the content of conversations, the photos, files and voice messages sent in the chat, read receipts.
  • Purpose: communication between the Client and the Specialist. Until an Offer is accepted, contact details written in messages (phone numbers, e-mail addresses, links, usernames) are replaced automatically before the message is saved.
  • Basis: performance of the contract and our legitimate interest in preventing fraud and circumvention of the Platform.

The Lumara team may read a conversation only when this is necessary to review a report, a dispute or a suspicion of fraud. Photos, files and voice messages sent in the chat are stored privately: only the two participants in the conversation can open them and, when the message is the subject of a report, the authorised members of the Lumara team reviewing it. Even so, do not send identity documents or other sensitive data in the chat that are not needed for the work.

Identity, company or licence verification

  • Data: photos of the identity document (front and back), a selfie, the company registration extract, the licence and the details entered alongside it (licence number, issuer, IDNO), and the verification decision.
  • Purpose: granting the "Verified" badge and preventing fraud.
  • Basis: your consent, given by ticking the consent box in the verification form; you can withdraw it at any time, in which case the badge is withdrawn. Without it we cannot carry out the verification, but the rest of the Platform remains available.
  • Protection: documents are encrypted (AES-256) before being saved, are kept in private storage and can be opened only by the authorised staff carrying out the verification.

Payments

  • Data: payments made (amount, plan, status, the transaction identifiers at maib), refunds, wallet movements, the IP address at the time of payment and an identifier of the card saved for recurring payments, together with its expiry date.
  • Purpose: collecting subscriptions, automatic renewal, refunds, accounting records and fraud prevention.
  • Basis: performance of the contract and our legal accounting and tax obligations.

Card details are entered directly on maib's secure page. Lumara does not receive or store the full card number or the CVV code.

Safety and moderation

  • Data: reports sent and received, signals from the automatic filters, moderation decisions, blocks, and IP addresses used to limit the number of attempts (for example, at sign-in or when sending codes).
  • Purpose: protecting users and the Platform against abuse, spam and fraud.
  • Basis: our legitimate interest, and that of users, in using a safe platform.

Consents

  • Data: the choices made in the cookie banner, acceptance of the Terms and the Privacy Policy when the account is created, consent to the verification of documents (the version accepted, the date, the IP address, the browser type) and an anonymous browser identifier.
  • Purpose: being able to show what you accepted and when.
  • Basis: the legal obligation to be able to prove consent, and our legitimate interest.

Notifications

We send notifications on the Platform, by e-mail and, where applicable, by SMS about your requests, offers, orders and messages (basis: performance of the contract). The channels can be configured in your account settings. We do not send marketing communications without your consent.

Statistics and advertising

Only if you accept the corresponding categories in the cookie banner do we use Google Analytics 4 (usage statistics) and Meta Pixel (measuring the effectiveness of ads). Basis: consent, which you can withdraw at any time. These tools are not currently enabled on the Platform; if we enable them, they will only load after you accept them. Details in the Cookie Policy.

Do you have to give us your data?

There is no legal obligation to give us your data. However, the data marked as required in the forms is needed to create an account and use the Platform (performance of the contract); without it we cannot provide that service. Consent to verification and to optional cookies is voluntary.

3. Who we share data with

We do not sell your data. We share it only with:

  • other users, to the extent necessary: the Specialist's public profile; the Request, with matching Specialists; contact details, with the other party once the Offer is accepted;
  • providers that process data on our behalf (the list below);
  • public authorities, when the law requires us to.

Our providers:

  • Vercel (USA) — application hosting (servers in Frankfurt, Germany) and file storage (Vercel Blob);
  • Neon (USA) — the database, hosted in the European Union (Frankfurt, Germany);
  • maib (Republic of Moldova) — card payment processing;
  • Resend (USA) — sending e-mails;
  • Twilio (USA) — sending SMS messages;
  • Google, Apple and Meta — only if you choose to sign in with that account;
  • Google (Google Analytics 4) and Meta (Meta Pixel) — only with your consent.

4. Transfers outside the Republic of Moldova

Some providers are companies based in the United States of America, and certain data — for example, uploaded files — may be stored in the USA. We transfer data only with appropriate safeguards, such as contractual data protection clauses agreed with the providers, and only under the conditions permitted by Law No. 195/2024 on the protection of personal data. On request, we can give you information about these safeguards.

5. How long we keep data

  • Account and activity data — for as long as the account is active. When the account is deleted, its personal data is anonymised immediately, except for the data below.
  • Verification documents — for the duration of the verification and then for the period set in the Platform's settings (90 days from the decision by default). After this period the documents are deleted automatically; the result of the verification (the type and date) stays on the account.
  • Payment data and accounting documents — for the period required by the accounting and tax legislation of the Republic of Moldova.
  • Reviews — for as long as the Specialist's profile is active; after the author's account is closed they may remain published in anonymised form.
  • The log of consents and acceptances — for as long as necessary to be able to prove consent, including after it is withdrawn.
  • One-time codes sent by SMS — 5 minutes. Sign-in sessions — 7 days from last use.
  • Technical security data (IP addresses used to limit attempts) — deleted automatically, usually within two days.

6. Your rights

Under Law No. 195/2024 on the protection of personal data, you have the right:

  • to find out whether we process your data and to receive a copy of it;
  • to ask for inaccurate data to be corrected;
  • to ask for your data to be deleted or your account to be closed;
  • to ask for processing to be restricted;
  • to receive the data you provided in a structured format (portability);
  • to object to processing based on our legitimate interest;
  • to withdraw your consent at any time, without affecting processing carried out before then;
  • to lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md).

Much of your data you can see and change directly in your account. You can download a copy of your data (a JSON file) and delete your account yourself, from "Settings → My data". For any other request — including a copy or deletion, if you cannot do it from your account — send a written request to the address in the "Contact" section, stating the e-mail or phone linked to your account. We may ask you to confirm your identity. We respond free of charge, within the time limit set by law.

7. Data security

We use encrypted connections (HTTPS), passwords stored only as hashes, two-step authentication (mandatory for Lumara staff), encryption of verification documents, role-based staff access, limits on the number of attempts and anti-abuse filters. No measure is perfect; if we learn of a security breach that may affect you, we will inform you and notify the authority, as required by law.

8. Minors

The Platform is intended for people aged at least 18. We do not knowingly collect data about minors; if we learn that an account belongs to a minor, we close it.

9. Changes

We may update this policy. The current version is published on this page, with the date of the last update. If a change is significant, we will inform you on the Platform and, where applicable, ask you to accept it again.

10. Contact

SRL "BALAN PRO", IDNO 1013600015807

Address: MD-4829, Măgdăcești village, Criuleni district, Republic of Moldova